Link Escape

Here is an example where we were able to edit dynamic text and escape out of the websites continue button.

Why would this be dangerous? Well we could alter the text to say something like the server crashed and we need the user to login to restore their event data. When the user would click continue it would take them to a malicious site that records their login info and then passes them back to the legitimate site.

Note the company has since resolved this issue and on a side note their response time was 4mins.